The State of Rust in Malware Programming

PhD Research on Rust Binary Analysis and Malware Detection

Welcome

This site documents ongoing PhD research focused on the static and dynamic analysis of Rust binaries, particularly for malware reverse engineering. The goal is to advance open methodologies, tooling, and datasets that help the security community understand, detect, and analyze Rust-based threats.

📚 Documentation

🔬 Analysis

💾 Datasets

🛠️ Tools

Research Focus

This project investigates the characteristic features of Rust binaries, exploring:

  • Monomorphisation and generic code expansion
  • Trait objects and vtable structures
  • Name mangling and symbol analysis
  • Compilation pipeline impact on detection
  • Zero-cost abstractions in binary form

Key Features

  • ✅ Comprehensive Binary Analysis - In-depth exploration of Rust compiler output
  • ✅ Detection Frameworks - Scalable frameworks for automated Rust malware detection
  • ✅ Open Datasets - Curated collections of benign and malicious Rust binaries
  • ✅ Tool Integration - Support for IDA Pro, Ghidra, Binary Ninja, and more
  • ✅ Academic Research - Ongoing PhD research with methodology documentation

Getting Started

1. Install Rust and Tools

# Install Rust
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh

# Add cross-compilation targets
rustup target add x86_64-pc-windows-msvc
rustup target add i686-pc-windows-msvc

See the Installation Guide for detailed instructions.

2. Build Sample Projects

# Clone the repository
git clone https://github.com/Yen-Coder/The-State-of-Rust-in-Malware-Programming.git
cd The-State-of-Rust-in-Malware-Programming

# Build a sample project
cd docs/01-Rust-Binary-Analysis/01-basic_pl_concepts
cargo build --release

See Building Rust Samples for more options.

3. Analyse Binaries

Explore the compiled binaries in datasets/Benign-Samples/ using your favorite reverse engineering tools.

Project Structure

The-State-of-Rust-in-Malware-Programming/
├── src/                    # Detection framework & analysis tools
├── docs/                   # Documentation & research samples
│   ├── wiki/              # Comprehensive wiki
│   └── 01-Rust-Binary-Analysis/
├── datasets/              # Compiled binary samples
├── tools/                 # IDA/Ghidra scripts & utilities
└── README.md             # Project overview

See Project Structure for detailed organisation.

Recent Updates

  • ✨ Comprehensive wiki documentation added
  • 🔧 Aggressive optimisation configurations
  • 📦 x86 and x86-64 cross-compilation samples
  • 🧪 Basic programming language concepts analysis

Research Methodology

This research follows a systematic approach:

  1. Sample Generation - Create diverse Rust code samples
  2. Compilation - Build with various toolchains and optimisations
  3. Static Analysis - Analyse binaries with RE tools
  4. Dynamic Analysis - Runtime behavior observation
  5. Pattern Extraction - Identify Rust-specific signatures
  6. Detection Development - Build automated detection frameworks

Contributing

This is an active PhD research project. Contributions, feedback, and collaboration are welcome!

Resources

Documentation

External Resources

  • rust-re-tour - Rust RE exploration
  • Checkpoint Research - Rust binary analysis guide
  • “Reconstructing Rust Types” - RE//verse 2025: https://github.com/cxiao/reconstructing-rust-types-talk-re-verse-2025
  • “Reversing Rust Binaries: One Step Beyond Strings” - REcon 2024: https://github.com/cxiao/rust-reversing-workshop-recon-2024

License

See the LICENSE file for details.

Contact

🦀 Advancing Rust Malware Analysis Research 🦀

PhD Research Project - Actively Maintained